September 2003 - openSUSE Security - openSUSE Mailing Lists

Making shadow passwords compulsory
by Michael.James＠csiro.au 30 Sep '03

30 Sep '03

Suse's "passwd" utility has a bit of undesired behaviour. Most of my users don't have entries in shadow, they depend on pam_krb5 for authentication. So /etc/shadow is very short, it only has lines for root and a few sysadmins. I want for everyone else (system accounts like FTP and regular users) to be denied even the possibility of a locally stored password. Now in the past (under solaris) passwd would grumble and fail unless that username already had a line present in shadow. THIS passwd just bungs the encrypted string into /etc/passwd! Argh! Nobody ever wants to go back to un-shadowed passwords. How can I turn off this unwantedly obliging behaviour? TIA, michaelj -- Michael James michael.james(a)csiro.au System Administrator voice: 02 6246 5040 CSIRO Bioinformatics Facility fax: 02 6246 5166

3 3

pam_chroot
by Pep Serrano 28 Sep '03

28 Sep '03

Anybody is using pam_chroot? Cheers Pep Serrano.

3 3

Re: [suse-security] Firewall <-> CUPS
by Michael Graupner 26 Sep '03

26 Sep '03

Holger Schletz schrieb: >Hi, > >Your reply did not get posted to the list, so I will answer directly: > > > >>Sep 24 11:51:54 ptpp74 kernel: SuSE-FW-DROP-DEFAULT IN=eth0 OUT= >>MAC=00:50:fc:5c:dd:dc:00:d0:b7:93:ef:75:08:00 SRC= >>141.30.17.195 DST=141.30.17.254 LEN=60 TOS=0x00 PREC=0x00 TTL=64 >>ID=19456 DF PROTO=TCP SPT=51782 DPT=631 WINDOW=584 >>0 RES=0x00 SYN URGP=0 OPT (020405B40402080A0DEBEA270000000001030301) >> >>But I cannot interpret what is going on. >> >> >> > >It means that the machine 141.30.17.195 (SRC=...) tried to open a TCP >connection (PROTO=TCP) to your machine (DST=141.30.17.254) on port 631 >(DPT=631). The source address is not identical to the address you specified >in your firewall config (141.30.17.91). Is this a typo? > I know for sure that the CUPS server is 141.30.17.91. But even if I change the configuration to FW_TRUSTED_NETS="141.30.17.195,tcp,631" ( The option was spelled correclty, I have copied it in a uncomplete manner. ) the CUPS printer are not recognised. > >BTW, the line W_TRUSTED_NETS="141.30.17.91,tcp,631" is misspelled in your post >(must be "FW_TRUSTED_NETS=...", check your config file. > >Check the IP addresses and tell me what you see. > >Best regards, >Holger > > > > Best regards, Michael -- _____________________________________________ Michael Graupner Institute for Theoretical Physics Dresden University of Technology 01062 Dresden _____________________________________________

1 0

SSH - changed finger print
by Dominik Składanowski 26 Sep '03

26 Sep '03

Hello list, today during login to server by ssh, I've noticed that fingerprint of my key server has changed. I comapred keys with previous backups - keys are the same. It is strange, different fingerprint warning I get when I use PuTTY on my W2k workstation. When I try to login from my SuSE workstation I didn't get any warning. I use SuSE 8.2 Pro and latest patches to OpenSSH I have installed. -- ++++++++++++++++++++++++++++++++++++++++++ Dominik Składanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl ++++++++++++++++++++++++++++++++++++++++++

3 3

KMail 1.5.4 (KDE 3.1.4) and s/mime (cryptplug)
by Mathias Homann 25 Sep '03

25 Sep '03

Hi, seems that kmail 1.5.4 still cannot handle signed mails other than from the built-in gpg support. That _does_ suck. or can anyone who got my key from a keyserver verify this signed mail? bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

1 1

Firewall <-> CUPS
by Michael Graupner 25 Sep '03

25 Sep '03

Hello, Suse 8.2 with a 2.4.20-4GB-athlon kernel is running on my computer. In yast2 I have configured and got to work the SuSEfirewall. But since the firewall is working my computer does not recognise the CUPS printer installed on the local network. In /etc/sysconfig/SuSEfirewall2 under point 10 I have added: W_TRUSTED_NETS="141.30.17.91,tcp,631" where 141.30.17.91 refers to the CUPS server in the network and 631 is the ipp port. But even after a restart of the firewall with this configuration the printers are not seen by my computer. Do I have to allow more ports than only 631? Or are other configurations required in order to get CUPS working. I would appreciate any hints concerning this problem. Best regards Michael -- _____________________________________________ Michael Graupner Institute for Theoretical Physics Dresden University of Technology 01062 Dresden Germany _____________________________________________

3 2

Re: [suse-security] Why no SuSE RPMs for KDE 3.1.4 security update?
by r.maurizzi＠digitalpha.it 25 Sep '03

25 Sep '03

> Well, OpenLDAP + pam_ldap is not single sign-on: if you SSH into > host A and, from host A, you SSH again to host B, you will get > prompted for a user name and password. Oh, I see. With Kerberos authenticate once, and all systems recognize you. I interpreted "single sign on" as "single password for all services", using a probably old early-90 IBM definition (we were trying to do that "single password signon" with OS/2 back then :-) Indeed, it's a really nice thing to have. > That would take a lot of time, but I will try to resume it. > ... > ... > administration (well, nearly since passwords must be set > using Kerberos, but there are ways to integrate password > changes with Kerberos V). Really interesting and helpful! Many thanks! I'll try if I can get started, and if I'm able to reach the end I'll try to put somewhere a little Howto :-) Ciao, Roberto!

1 0

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

Re: [suse-security] Why no SuSE RPMs for KDE 3.1.4 security update?
by r.maurizzi＠digitalpha.it 25 Sep '03

25 Sep '03

> > How many do that using kerberos? > > I'm using Kerberos V. OpenSSH and OpenLDAP, for example, are using > Kerberos V authentication. Also, I'm using pam_krb5. Don't know why > there are so liitle people using Kerberos V. Single Sign-On is god > blessing. Do you also allow remote X logins for generic users using KDM? :-D On a more serious tone, I'm interested in the uses of Kerberos. I already have single sign on by using OpenLDAP + pam_ldap, and I still have to find a situation where an autentication system would be useful AND worth the management efforts and costs. But I feel like I could be very wrong on this :-) If you've the time, could you please write something on the management of such a system, the problems one could encunter, the kind of users you think could benefit from this, etc? Many thanks in advance! :-) Ciao, Roberto

2 1

openssh-3.5p1-107 tunneling problems
by Michael Galloway 25 Sep '03

25 Sep '03

good day all ... i upgraded to the openssh-3.5p1-107 rpms over the weekend and now i've a problem with tunneling. i use an ssh tunnel to make irc connections, now when i make an irc connection over the tunnel i connect as user root instead of as the user i make the tunnel with: ssh 6669:irc.freenode.net:6667 michael(a)host.domain.org then i run the irc client on the localhost and connect as usual, however, whois looks like this: [irc_nick] (root(a)ip.host.domain.org) : My Full Name both the localhost and the remote host are at openssh-3.5p1-107 and this somewhat bad behavior began after the upgrade. the sshd_config is the stock that came with the rpm. am i missing something? -- michael

4 5